Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/05/2024, 11:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://click-notification.capitalone.com/f/a/-GkdF9c1kWiGdpK-u1_AJQ~~/AAAAAQA~/RgRoCip0P0QbaHR0cHM6Ly93d3cuY2FwaXRhbG9uZS5jb20vVwZjYXBvbmVCCmYgdKUnZjB6XkRSFGdhcnlAc3RlcGhlbmJlcmcuY29tWAQAAAAA
Resource
win11-20240426-en
General
-
Target
https://click-notification.capitalone.com/f/a/-GkdF9c1kWiGdpK-u1_AJQ~~/AAAAAQA~/RgRoCip0P0QbaHR0cHM6Ly93d3cuY2FwaXRhbG9uZS5jb20vVwZjYXBvbmVCCmYgdKUnZjB6XkRSFGdhcnlAc3RlcGhlbmJlcmcuY29tWAQAAAAA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606765589217178" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 4620 chrome.exe 4620 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe Token: SeShutdownPrivilege 2312 chrome.exe Token: SeCreatePagefilePrivilege 2312 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe 2312 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 3712 2312 chrome.exe 77 PID 2312 wrote to memory of 3712 2312 chrome.exe 77 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 440 2312 chrome.exe 78 PID 2312 wrote to memory of 4232 2312 chrome.exe 79 PID 2312 wrote to memory of 4232 2312 chrome.exe 79 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80 PID 2312 wrote to memory of 3812 2312 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click-notification.capitalone.com/f/a/-GkdF9c1kWiGdpK-u1_AJQ~~/AAAAAQA~/RgRoCip0P0QbaHR0cHM6Ly93d3cuY2FwaXRhbG9uZS5jb20vVwZjYXBvbmVCCmYgdKUnZjB6XkRSFGdhcnlAc3RlcGhlbmJlcmcuY29tWAQAAAAA1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe6db6ab58,0x7ffe6db6ab68,0x7ffe6db6ab782⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1504 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:22⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2144 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:82⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:12⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:12⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3452 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:12⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3172 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:12⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3164 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:12⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:82⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=936 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3204 --field-trial-handle=1780,i,6670929321969447049,16890099560676937382,131072 /prefetch:12⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD538e06b75b1bc7b988c5fc64df0d3af5c
SHA16ce062a223543367bdd5673de1a0557b1eaaaa4b
SHA2567e2ef858a04fa3f17583d4983f73722f10bf2f16c1b3999a198b34230cdfc030
SHA51282d6e8a4ba04f12c63ae79b63ab2ce9fe6db521152e37ddb9540f3d5b78119eaee2b83de898bec3ff71fc3655674edc3c5ecd620c3ea89b5b68faa66f3e16130
-
Filesize
120B
MD5ed15328f0ef2527051cfdf76fcbdb556
SHA139125082bc6ded2fc67ec19fca1ba3197b54c749
SHA25663d1e17cf241d2947d44005582c999bb758f70ad27f5f2afb7e882cb09310d26
SHA5120353fdb9d0f8dc364d487eff47dd15d87f036dbb115462c5fde86e9b8921156fa5791e681b80c6a285ad71dbb299d9ad8a334b9b6560601e8b3aa6602af0ff57
-
Filesize
1KB
MD5dee926dd6938b04d1ba604160ad656db
SHA107baf35fbaae4dd520aeca9b2d109374d735cd1f
SHA25624df70ea36580df24375903b8a2950584a8f41f67ca6232c00f542e3c0a0a33b
SHA512c52052f5ebeddb30b0b0971ea63efbc0a3eb994c882e46d809c054b1dd49cef56e733b416ccb00444861faaa285a19f48ed6b1ae448836011dddce3b321a20bc
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5ab7047e6cc528a1a31f05ca3bd4b1edf
SHA19f0b4f48e115beb7e19373c8c75f3d855fed461b
SHA2565a852df7e541978bec366e4425ec5ae771ce545154565b7be59371a8332f5538
SHA51241782216eaf7b57eb598841dd3ffd1607ebf51b6ec891a4eb0cb45b9e8171366daf62d2f11411e7869355e252a9898c6ac51b343e2a76ce89ac3bd93271666c7
-
Filesize
7KB
MD5e032307b146dd62738e62e9794a596fc
SHA1bcb6f66c73d48589607ccf6cbc15b213f8e70239
SHA2569d73c2afce8efaa1add70e5c7ecbe13cf7c5a3b00356139313c1de0049f20f82
SHA512107a0ff337f1f0a71000713070fcb3aa1ae65f91a2981fec72604c937c2d59c307157d53f4e42b8a208fc7e588409ff92240050030d0af8b52eb6e02d4b2aafa
-
Filesize
130KB
MD5d2e3949746a57e3651c15cda8affe1c1
SHA19b071aa32df38f68d772308ed771da4b6f08175f
SHA2562f5ca0f3b811637f6e316368dd4d05fc27c2e4cd736459301fe1d8f45675666f
SHA512f29aff8ac5e5ecaad3fc5cf91062949675bae8e74cc0d515ef774b1a2c2e4894a9d24e3e8d57d49205fd7d522e6fb7a5bd5aca6b8ec4c834a0142781d2b42f5b